Go to the main menu
Skip to content
Go to bottom
REFERENCE LINKING PLATFORM OF KOREA S&T JOURNALS
> Journal Vol & Issue
Journal of the Korea Institute of Information Security and Cryptology
Journal Basic Information
Journal DOI :
Korea Institutes of Information Security and Cryptology
Editor in Chief :
Volume & Issues
Volume 26, Issue 4 - Aug 2016
Volume 26, Issue 3 - Jun 2016
Volume 26, Issue 2 - Apr 2016
Volume 26, Issue 1 - Feb 2016
Selecting the target year
Matchmaker: Fuzzy Vault Scheme for Weighted Preference
Purevsuren, Tuvshinkhuu ; Kang, Jeonil ; Nyang, DaeHun ; Lee, KyungHee ;
Journal of the Korea Institute of Information Security and Cryptology, volume 26, issue 2, 2016, Pages 301~314
DOI : 10.13089/JKIISC.2016.26.2.301
Juels and Sudan's fuzzy vault scheme has been applied to various researches due to its error-tolerance property. However, the fuzzy vault scheme does not consider the difference between people's preferences, even though the authors instantiated movie lover' case in their paper. On the other hand, to make secure and high performance face authentication system, Nyang and Lee introduced a face authentication system, so-called fuzzy face vault, that has a specially designed association structure between face features and ordinary fuzzy vault in order to let each face feature have different weight. However, because of optimizing intra/inter class difference of underlying feature extraction methods, we can easily expect that the face authentication system does not successfully decrease the face authentication failure. In this paper, for ensuring the flexible use of the fuzzy vault scheme, we introduce the bucket structure, which differently implements the weighting idea of Nyang and Lee's face authentication system, and three distribution functions, which formalize the relation between user's weight of preferences and system implementation. In addition, we suggest a matchmaker scheme based on them and confirm its computational performance through the movie database.
A Preimage Attack on the MJH Hash Function
Lee, Jooyoung ; Kim, Jongsung ;
Journal of the Korea Institute of Information Security and Cryptology, volume 26, issue 2, 2016, Pages 315~318
DOI : 10.13089/JKIISC.2016.26.2.315
In this paper, we present a new preimage attack on MJH, a double-block-length block cipher-based hash function. Currently, the best attack requires
queries for the 2n-bit MJH hash function based on an n-bit block cipher, while our attack requires
queries and the same amount of memory, significantly improving the query complexity compared to the existing attack.
A Study on Service Security Framework for SW-IaaS Cloud
Choi, Myeonggil ; Park, Choonsik ; Jeong, Jaehun ;
Journal of the Korea Institute of Information Security and Cryptology, volume 26, issue 2, 2016, Pages 319~325
DOI : 10.13089/JKIISC.2016.26.2.319
Cloud computing-related security incidents have occurred recently are beyond the scope of a enterprise's security incident is expanded to the entire range of customers who use the cloud computing environment. The control technology for the overall integrated security of the cloud data center is required for this purpose. This study research integrated and additional security elements for the cloud data center control to understand the existing control technology. It is a better understanding of the IaaS cloud environment to build the IaaS cloud environment by CloudStack. SW-IaaS cloud structure by combining CloudStack and IaaS cloud model presented by NIST is proposed in this study. This paper derive a security framework to consider in each layer of The SW-IaaS cloud components, which are composed of the Cloud Manager, Cluster Manager, and Computer Manager.
Key Recovery Algorithm for Randomly-Decayed AES Key Bits
Baek, Yoo-Jin ;
Journal of the Korea Institute of Information Security and Cryptology, volume 26, issue 2, 2016, Pages 327~334
DOI : 10.13089/JKIISC.2016.26.2.327
Contrary to the common belief, DRAM which is used for the main memory of various computing devices retains its content even though it is powered-off. Especially, the data-retaining time can increase if DRAM is cooled down. The Cold Boot Attack, a kind of side-channel attacks, tries to recover the sensitive information such as the cryptographic key from the powered-off DRAM. This paper proposes a new algorithm which recovers the AES key under the symmetric-decay cold-boot-attack model. In particular, the proposed algorithm uses the strategy of reducing the size of the candidate key space by testing the randomness of the extracted AES key bit stream.
Analysis and Countermeasure on RSA Algorithm Having High Attack Complexity in Collision-Based Power Analysis Attack
Kim, Suhri ; Kim, Taewon ; Jo, Sungmin ; Kim, HeeSeok ; Hong, Seokhie ;
Journal of the Korea Institute of Information Security and Cryptology, volume 26, issue 2, 2016, Pages 335~344
DOI : 10.13089/JKIISC.2016.26.2.335
It is known that power analysis is one of the most powerful attack in side channel analysis. Among power analysis single trace attack is widely studied recently since it uses one power consumption trace to recover secret key of public cryptosystem. Recently Sim et al. proposed new exponentiation algorithm for RSA cryptosystem with higher attack complexity to prevent single trace attack. In this paper we analyze the vulnerability of exponentiation algorithm described by Sim et al. Sim et al. applied message blinding and random exponentiation splitting method on
for higher attack complexity. However we can reveal private key using information exposed during pre-computation generation. Also we describe modified algorithm that provides higher attack complexity on collision attack. Proposed algorithm minimized the reuse of value that are used during exponentiation to provide security under single collision attack.
Digital Legal Seal for Message Authentication Code
Jung, ChangHun ; Shin, DongOh ; Jang, RhongHo ; Nyang, DaeHun ; Lee, KyungHee ; Youm, Heung-Youl ;
Journal of the Korea Institute of Information Security and Cryptology, volume 26, issue 2, 2016, Pages 345~358
DOI : 10.13089/JKIISC.2016.26.2.345
In this paper, we present a security tool which called Digital Legal Seal. The Digital Legal Seal scans a barcode on a paper and print it with the tag generated by Hash-based Message Authentication Code(HMAC) in text format on a display device. The result of HMAC can be used for user authentication or secure message transmission on both online and offline. We examine not only how the Digital Legal Seal can make up the weak points of security card and OTP (One Time Password), but also the possibility of reducing the forgery of promissory note on offline.
Building a Database of DQT Information to Identify a Source of the SmartPhone JPEG Image File
Kim, MinSik ; Jung, Doowon ; Lee, Sang-jin ;
Journal of the Korea Institute of Information Security and Cryptology, volume 26, issue 2, 2016, Pages 359~367
DOI : 10.13089/JKIISC.2016.26.2.359
As taking pictures by using smartphones has become more common in society, there are many incidents which are unexpected manipulation of images and leak of confidential information. Because of those incidents, demands that identify forgery/alteration of image file and proves of the original copy is constantly increasing. In general, smartphone saves image file as JPEG form and it has DQT which determines a compression rate of image in a header part of image. There is also DQT in Thumbnail image which inside of JPEG. In previous research, it identified a smartphone which take image by only using DQT, However, the research has low accuracy to identify the devices. There are two main purposes in this research. First, this research will analogize a smartphone and an application that takes a picture, edits and save an image file by testing not only about a DQT information but also a information of Thumbnail image. Second, the research will build a database of DQT and Thumbnail information in JPEG file to find more accurate image file's origin.
The Proactive Threat Protection Method from Predicting Resignation Throughout DRM Log Analysis and Monitor
Hyun, Miboon ; Lee, Sangjin ;
Journal of the Korea Institute of Information Security and Cryptology, volume 26, issue 2, 2016, Pages 369~375
DOI : 10.13089/JKIISC.2016.26.2.369
Most companies are willing to spend money on security systems such as DRM, Mail filtering, DLP, USB blocking, etc., for data leakage prevention. However, in many cases, it is difficult that legal team take action for data case because usually the company recognized that after the employee had left. Therefore perceiving one's resignation before the action and building up adequate response process are very important. Throughout analyzing DRM log which records every single file's changes related with user's behavior, the company can predict one's resignation and prevent data leakage before those happen. This study suggests how to prevent for the damage from leaked confidential information throughout building the DRM monitoring process which can predict employee's resignation.
Efficient Exploring Multiple Execution Path for Dynamic Malware Analysis
Hwang, Ho ; Moon, Daesung ; Kim, Ikkun ;
Journal of the Korea Institute of Information Security and Cryptology, volume 26, issue 2, 2016, Pages 377~386
DOI : 10.13089/JKIISC.2016.26.2.377
As the number of malware has been increased, it is necessary to analyze malware rapidly against cyber attack. Additionally, Dynamic malware analysis has been widely studied to overcome the limitation of static analysis such as packing and obfuscation, but still has a problem of exploring multiple execution path. Previous works for exploring multiple execution path have several problems that it requires much time to analyze and resource for preparing analysis environment. In this paper, we proposed efficient exploring approach for multiple execution path in a single analysis environment by pipelining processes and showed the improvement of speed by 29% in 2-core and 70% in 4-core through experiment.
Study on Recovery Techniques for the Deleted or Damaged Event Log(EVTX) Files
Shin, Yonghak ; Cheon, Junyoung ; Kim, Jongsung ;
Journal of the Korea Institute of Information Security and Cryptology, volume 26, issue 2, 2016, Pages 387~396
DOI : 10.13089/JKIISC.2016.26.2.387
As the number of people using digital devices has increased, the digital forensic, which aims at finding clues for crimes in digital data, has been developed and become more important especially in court. Together with the development of the digital forensic, the anti-forensic which aims at thwarting the digital forensic has also been developed. As an example, with anti-forensic technology the criminal would delete an digital evidence without which the investigator would be hard to find any clue for crimes. In such a case, recovery techniques on deleted or damaged information will be very important in the field of digital forensic. Until now, even though EVTX(event log)-based recovery techniques on deleted files have been presented, but there has been no study to retrieve event log data itself, In this paper, we propose some recovery algorithms on deleted or damaged event log file and show that our recovery algorithms have high success rate through experiments.
Illegal and Harmful Information Detection Technique Using Combination of Search Words
Han, Byeong Woo ; Yoon, Ji Won ;
Journal of the Korea Institute of Information Security and Cryptology, volume 26, issue 2, 2016, Pages 397~404
DOI : 10.13089/JKIISC.2016.26.2.397
Illegal and harmful contents on the Internet has been an issue and been increased in Korea. They are often posted on the billboard and website of small enterprise and government office. Those illegal and harmful contents can relate to crime and suspicious activity, so, we need a detection system. However, to date the detection itself has been conducted manually by a person. In this paper, we develop an automated URL detection scheme for detecting a drug trafficking by using Google. This system works by analyzing the frequently used keywords in a drug trafficking and generate a keyword dictionary to store words for future search. The suspected drug trafficking URL are automatically collected based on the keyword dictionary by using Google search engine. The suspicious URL can be detected by classifying and numbering each domain from the collection of the suspected URL. This proposed automated URL detection can be an effective solution for detecting a drug trafficking, also reducing time and effort consumed by human-based URL detection.
A Proactive Inference Method of Suspicious Domains
Kang, Byeongho ; YANG, JISU ; So, Jaehyun ; Kim, Czang Yeob ;
Journal of the Korea Institute of Information Security and Cryptology, volume 26, issue 2, 2016, Pages 405~413
DOI : 10.13089/JKIISC.2016.26.2.405
In this paper, we propose a proactive inference method of finding suspicious domains. Our method detects potential malicious domains from the seed domain information extracted from the TLD Zone files and WHOIS information. The inference process follows the three steps: searching the candidate domains, machine learning, and generating a suspicious domain pool. In the first step, we search the TLD Zone files and build a candidate domain set which has the same name server information with the seed domain. The next step clusters the candidate domains by the similarity of the WHOIS information. The final step in the inference process finds the seed domain's cluster, and make the cluster as a suspicious domain set. In experiments, we used .COM and .NET TLD Zone files, and tested 10 seed domains selected by our analysts. The experimental results show that our proposed method finds 55 suspicious domains and 52 true positives. F1 scores 0.91, and precision is 0.95 We hope our proposal will contribute to the further proactive malicious domain blacklisting research.
Legislative Reform of Smart Grid Privacy Act
Lee, Donghyeok ; Park, Namje ;
Journal of the Korea Institute of Information Security and Cryptology, volume 26, issue 2, 2016, Pages 415~423
DOI : 10.13089/JKIISC.2016.26.2.415
Smart grid systems can be real-time information exchange between suppliers and consumers, and provides a lot of convenience. However, the risk to the user's personal information exposure is ever-present. Depending on the characteristic of the smart grid environment, there is a threat of the disclosure of personal information based on the personal information life-cycle, and can also be exposed a variety of information based on energy consumption pattern analysis. In this paper, we analyze the existing privacy act in the smart grid and propose improvements for the existing directive.
A Proposal of Risk Management Framework for Design as a Secure Power Control System
Park, Jun Yong ; Shin, Sumin ; Song, Kyoung-Young ;
Journal of the Korea Institute of Information Security and Cryptology, volume 26, issue 2, 2016, Pages 425~433
DOI : 10.13089/JKIISC.2016.26.2.425
In smart grid, enhancement of efficiency and interoperability of electric power system is achieved through the connection with outer network, and this induces that power grid system is threatened increasingly, becomes the main target of cyber terrorism, and is sincerely required to design the secure power system. Although SSDLC(Secure System Development Life Cycle) is used for risk management from the design phase, traditional development life cycle is somewhat limited for satisfaction of information security indicator of power control system. Despite that power control system should reflect control entities of information security considering its own characteristics, validation elements are insufficient to apply into real tasks based on existing compliance. To make design of diagnostic model and assessment process for power control system possible and to give a direction for information security and present related indicator, we propose the new risk management framework of power control system which is applied operational security controls and standard architecture presented by IEC 62351 TC 57 with enterprise risk management framework.
A Study on the Possibility of Assuring 'The Right to be Forgotten' Through the Digital Extinction Technology
Joo, Moon-ho ; Lim, Jong-in ;
Journal of the Korea Institute of Information Security and Cryptology, volume 26, issue 2, 2016, Pages 435~447
DOI : 10.13089/JKIISC.2016.26.2.435
As data can be permanently stored and freely distributed, in modern society, the Internet became a world that remembers everything forever. Because of that, there has been increasing the number of accident with never-forgetting data and, as a result, a movement has been emerged to apply a notion of 'oblivion' to internet world. The movement is called 'The right to be forgotten.' However, 'The right to be forgotten' in a higher level which internet users want to be guaranteed is very limited in the juridical approach because of the confliction with the other basic rights and problems. On the other hand, the requests of individuals to guarantee 'The right to be forgotten' has been urged digital extinction technology, such as volatile SNS, Digital Aging System, to be developed. With introduction of oblivion, digital extinction technology with setting expire date on digital information can present a new solution on assuring 'The right to be forgotten.' This research establishes the detail scope of, analyzes the level of assurance of, and, through digital extinction technology with the established scope, suggest the potential assurance of the 'The right to be forgotten'.
Factors Affecting Information Security Practice of Elementary School Students
Choi, Seung-Jae ; Kim, Hyeong-Yeol ; Kim, Tae-Sung ;
Journal of the Korea Institute of Information Security and Cryptology, volume 26, issue 2, 2016, Pages 449~461
DOI : 10.13089/JKIISC.2016.26.2.449
If students are not aware of the information security, they easily let others know their information or they use others' information with no sense of guilt. The information security education is necessary to protect and prevent students from cyber crime. However, South Korea's information curriculum has no specific information security education course and it has led a school or teacher to teach contents of information ethics superficially. The purpose of this paper is to find the factors affecting the information security practice of the elementary school students. For an empirical analysis, questionnaire survey was conducted and the Partial Least Square(PLS) was used to analyze the research model. The analysis results show that the information ethics awareness and the information security awareness have a positive impact on the information security practice. The results of this study are expected to help choose the specific information security curriculum required for the information security practice of elementary school students.
Effect of Information Security Incident on Outcome of Investment by Type of Investors: Case of Personal Information Leakage Incident
Eom, Jae-Ha ; Kim, Min-Jeong ;
Journal of the Korea Institute of Information Security and Cryptology, volume 26, issue 2, 2016, Pages 463~474
DOI : 10.13089/JKIISC.2016.26.2.463
As IT environment has changed, paths of information security in financial environment which is based on IT have become more diverse and damage caused by information leakage has been more serious. Among security incidents, personal information leakage incident is liable to give the greatest damage. Personal information leakage incident is more serious than any other types of information leakage incidents in that it may lead to secondary damage. The purpose of this study is to find how much personal information leakage incident influences corporate value by analyzing 21 cases of personal information leakage incident for the last 15 years 1,899 listing firm through case research method and inferring investors' response of to personal information leakage incident surveying a change in transaction before and after personal information leakage incident. This study made a quantitative analysis of what influence personal information leakage incident has on outcome of investment by types of investors by classifying types of investors into foreign investors, private investors and institutional investors. This study is significant in that it helps improve awareness of importance of personal information security by providing data that personal information leakage incident can have a significant influence on outcome of investment as well as corporate value in Korea stock market.
Improving Security Awareness about Smishing through Experiment on the Optimistic Bias on Risk Perception
Kang, Ji Won ; Lee, Ae Ri ; Kim, Beomsoo ;
Journal of the Korea Institute of Information Security and Cryptology, volume 26, issue 2, 2016, Pages 475~487
DOI : 10.13089/JKIISC.2016.26.2.475
Recently, various risks of smartphone hacking are emerging. Smishing crime techniques become more cunning and its damage has been increasing, thereby requiring effective ways of preventing and coping with smishing. Especially, it is emphasized the need for smartphone users' security awareness and training besides technological approach. This study investigates the effective method for providing news messages in order to improve the perception of risk from smishing. This research empirically examines that the degree of optimistic bias on risk perception can vary depending on news frame, topic type, and involvement regarding smishing. Based on the findings, it identifies the factors influencing risk perception and verifies effective ways of promoting individual security awareness on smishing. The results of this study provide implications that assist in educating, campaigning and promoting information security awareness for smart device users.
An Analysis of Research Trends in Information Security Education
Kim, Kunwoo ; Kim, Jungduk ;
Journal of the Korea Institute of Information Security and Cryptology, volume 26, issue 2, 2016, Pages 489~499
DOI : 10.13089/JKIISC.2016.26.2.489
Nowadays the importance of information security has been increased because there are many benefits and threats like information leakage caused by rapid growth of information technology. It is important to apply technical solution, however enhancing security capability is more important to respond evolving security threats. Information security education is one of typical way to enhance security capability and there are various efforts at the dimension of nation, company and academic community. However it is required to analyze previous research until now and derive future research direction for long-term development plan. In this study, we analyzed a publication status about 177 papers related to information security, training and awareness from 4 foreign journals and 2 Korean journals. Additionally, we analyzed in detail about 70 papers related to information security education. As a result, the most part of study is about curriculum, and in the future, it is required to expand educational area as well as study about effectiveness measurement of information security education by experimental research.
A Study on the Privacy Literacy Level Measurement for the Proper Exercise of the Right to Informational Self-Determination
Park, Hyang-mi ; Yoo, Ji-Yeon ;
Journal of the Korea Institute of Information Security and Cryptology, volume 26, issue 2, 2016, Pages 501~522
DOI : 10.13089/JKIISC.2016.26.2.501
In the digital era, information is a source of value creation. However, the growing importance of knowledge and information also increases risks and threats. When information is leaked, full recovery is difficult, and additional spreading of risk is high because it is easy to accomplish. Especially personal information is the main target due to its availability. Although individuals normally have to consent to the use of their personal information, they often do not know the use of their information. In such a difficult situation, one must exercise self-determination and privacy. Therefore, the goal of this study is to development a privacy literacy level measurement model for the proper exercise of the right to informational self-determination. It will be presented with the concept of privacy literacy index in order to determine the level of knowledge and understanding and practical application skills for individual. Through the index, we going to enhance the selection ability of information subject, and to promote the judgement and the determination capability for the protection and utilization of personal information.
Effects and Causality of Measures for Personal Information: Empirical Studies on Firm and Individual Behaviors and their Implications
Shin, Ilsoon ;
Journal of the Korea Institute of Information Security and Cryptology, volume 26, issue 2, 2016, Pages 523~531
DOI : 10.13089/JKIISC.2016.26.2.523
This paper studies the empirical relationship between various privacy protection measures and personal information invasion experience of firms and individuals using rich and heterogeneous survey data. By analyzing PSM models. we get the following results: first, the treatment group which have more technical measures and/or IS investment tends to experience more privacy invasion than the control group which have less of them. second, the reverse causality, that is firms and individuals with more experience of privacy invasion tends to take more measure for personal information protection, is found to exist. From these result, we discuss proper privacy policies implications in respects of attackers benefits and individual irrationality.
Research on System Architecture and Simulation Environment for Cyber Warrior Training
Ahn, Myung Kil ; Kim, Yong Hyun ;
Journal of the Korea Institute of Information Security and Cryptology, volume 26, issue 2, 2016, Pages 533~540
DOI : 10.13089/JKIISC.2016.26.2.533
It is important to establish the environment for cyber warrior training, testing support and effectiveness analysis in order to cope with sharply increasing cyber threat. However, those practices cannot be easily performed in real world and are followed with many constraints. In this paper, we propose a live/virtual M&S-based system for training/testing and constructive M&S-based system for effectiveness analysis to provide an environment similar to real world. These can be utilized to strengthen the capability to carry out cyber war and analyze the impact of cyber threat under the large-scale networks.
Improvement of the Certification Model for Enhancing Information Security Management Efficiency for the Financial Sector
Oh, Eun ; Kim, Tae-Sung ; Cho, Tae-Hee ;
Journal of the Korea Institute of Information Security and Cryptology, volume 26, issue 2, 2016, Pages 541~550
DOI : 10.13089/JKIISC.2016.26.2.541
Considering the results of the 3.20 Cyber Attack, leaks of personal information by card companies, and so on, convenience and efficiency cannot be guaranteed without security as a prerequisite. In addition, it is more likely that customers' interests seem to be interfered with in financial institutions than in any other industry. Therefore, when a security accident occurs, users may suffer mental damage and monetary loss, leading to class action, customer defection, loss of reputation, and falloff in international credibility, which all may have a significant effect on the business continuity of corporations. This study integrates the representative information security certification systems in order to improve the efficiency of information security management and demonstrate the necessity of information security management system certification for the financial sector. If the certification is needed, we would like to recommend the desirable development direction.
A Study on Quantitative Method of Certificate for Information Security Education Course in the Private Sector
Kim, Joo-hee ; Cho, Sung-woo ; Yoo, Dong-young ;
Journal of the Korea Institute of Information Security and Cryptology, volume 26, issue 2, 2016, Pages 551~558
DOI : 10.13089/JKIISC.2016.26.2.551
The recent convergence in ICT industry has created new businesses as well as other opportunities. However, it entails new convergence threat accompanied by security risks. Even though there are security professionals who are dealing with the situation, there is not enough human resource in risk management. Moreover, the amount of research that studies quality of education and training security personnel is not sufficient. This paper explores the curriculum of information security education in the private sector and reasons out fifteen standard curriculums in four professional fields categorized by job classification. In addition, it provides a weighted score table based on the evaluation indicator for the effective security education certificates in the private sector.